obront - No check for active Arbitrum Sequencer in WSTETH Oracle
sherlock-admin opened this issue · 2 comments
obront
medium
No check for active Arbitrum Sequencer in WSTETH Oracle
Summary
Chainlink recommends that all Optimistic L2 oracles consult the Sequencer Uptime Feed to ensure that the sequencer is live before trusting the data returned by the oracle. This check is implemented in ArbiChainlinkOracle.sol, but is skipped in WSTETHOracle.sol.
Vulnerability Detail
If the Arbitrum Sequencer goes down, oracle data will not be kept up to date, and thus could become stale. However, users are able to continue to interact with the protocol directly through the L1 optimistic rollup contract. You can review Chainlink docs on L2 Sequencer Uptime Feeds for more details on this.
As a result, users may be able to use the protocol while oracle feeds are stale. This could cause many problems, but as a simple example:
- A user has an account with 100 tokens, valued at 1 ETH each, and no borrows
- The Arbitrum sequencer goes down temporarily
- While it's down, the price of the token falls to 0.5 ETH each
- The current value of the user's account is 50 ETH, so they should be able to borrow a maximum of 200 ETH to keep account healthy (
(200 + 50) / 200 = 1.2
) - Because of the stale price, the protocol lets them borrow 400 ETH (
(400 + 100) / 400 = 1.2
)
Impact
If the Arbitrum sequencer goes down, the protocol will allow users to continue to operate at the previous (stale) rates.
Code Snippet
Tool used
Manual Review
Recommendation
Add the same check to WSTETHOracle.sol that exists in ArbiChainlinkOracle.sol:
function getPrice(address token) external view override returns (uint) {
if (!isSequencerActive()) revert Errors.L2SequencerUnavailable();
...
}
function isSequencerActive() internal view returns (bool) {
(, int256 answer, uint256 startedAt,,) = sequencer.latestRoundData();
if (block.timestamp - startedAt <= GRACE_PERIOD_TIME || answer == 1)
return false;
return true;
}
Fix PR: sentimentxyz/oracle#46
PR confirmed.